![]() I regularly use the Tableau T9 Fire write block (Figure 3) for my Mac imaging jobs and either a Windows or Mac host with the respective forensic imaging software to then create the image. However there is an easier and in my view perhaps lower risk alternative to opening the case and removing the hard drive on a Mac - use a Firewire write block in Target Mode. as they can be different specific lengths. So yes it can be done as long as you have the tools, are patient, careful, slow and methodical - carefully organizing each screw you remove so they go back in the right place etc. In my practice with most Mac imaging jobs it can be as little as 15 minutes to half an hour to gain access to the hard drive and another 15 minutes to half an hour to get it back together. There are several step-by-step guides to remove the hard drive from both Mac desktops and laptops available on the Internet. Today's Unibody laptops like the MacBook and MacBook Pro have a removable rear panel that allows access to both the battery and hard drive. Older Mac laptops permitted access to the hard drive by first removing the battery and then a few screws in the battery compartment to gain access to the hard drive. However some of the desktops require removing the glass panel with a heavy duty suction cup (Figure 2) then removing the LCD assembly before access can be had to the hard drive. Depending on the model of the desktop with a set of Torx screw drivers, scissor clamp and tweezers (Figure 1) in hand, it could be as simple as removing a few screws to open the case to gain access to the hard drive. It is really a matter of personal opinion, Mac's are an engineering marvel just ask anyone that has had to remove a hard drive from a Mac for forensic imaging and then try to put it back together properly. Immediately apply the skills and techniques learned in SANS courses, ranges, and summitsĬan a Mac hard drive be easily removed for imaging with a forensic hardware imager?
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |